Over the past two days, I’ve seen someone get their wallet pulled away by a phishing site again. Basically, it’s still the same few red lines: never type your seed phrase into a webpage—no matter how much the page looks like the real thing; when signing, don’t just look at “Confirm,” take a closer look at what you’re authorizing, especially those “infinite authorization limits”—they’re genuinely pretty scary. I’m not trying to scare anyone; anyway, once the money is on-chain, it’s very hard to get it back once it’s gone.

Later, I found out that labels on some on-chain data tools also aren’t necessarily reliable—there could be delays or even misinformation—so don’t place too much faith in “this address looks safe.” What I do now is: I never click unfamiliar links; if I really need to interact, I test with a small amount or a new wallet first; I periodically clean up and revoke authorizations—I’d rather deal with the hassle.